Incident Detection and Triage · Topic 5 of 6
Alert Triage and Analysis
Learn how SOC analysts triage alerts: validate true and false positives, enrich, prioritize by asset value, then escalate and document for CSA 312-39.
- 4 min
- Triage order: acknowledge, validate, enrich, classify, prioritize, decide, document.
- True positive = real and alerted; false positive = alerted but benign; false negative = real but missed.
- Priority combines severity of activity with criticality of the asset and user.
What it is
Alert triage is the first look at each alert to decide whether it is real, how serious it is, and what happens next. It is mainly the job of the Tier I analyst. Analysis goes deeper: gathering evidence and context to understand what happened, often by a Tier II analyst after escalation.
Good triage protects the SOC from two failures: missing a real attack, and wasting time on noise.
How it works
Alert outcomes
| Outcome | Meaning | Result |
|---|---|---|
| True positive | Alert fired and the activity is malicious | Escalate and respond |
| False positive | Alert fired but the activity is benign | Close, and tune the rule if it repeats |
| True negative | No alert and no malicious activity | Normal state |
| False negative | No alert but malicious activity happened | The most dangerous case; a detection gap |
Some SOCs also use benign true positive: the rule worked as designed, but the activity is authorized, such as a penetration test or an approved admin task.
Triage steps
- Acknowledge the alert so others know it is being handled.
- Read the alert: rule name, time, source, destination, user, host, raw events.
- Validate: check the raw logs. Did the activity really happen as described?
- Enrich: add context.
- Asset: what the host is, who owns it, how critical it is.
- User: role, normal behavior, privileges, recent changes.
- Threat intelligence: reputation of addresses, domains and file hashes.
- History: related alerts on the same host or user.
- Classify as true positive, false positive or benign.
- Prioritize by severity and impact.
- Decide: close with notes, escalate to Tier II, or start the incident response playbook.
- Document findings, evidence and reasoning in the ticket.
Prioritization
Priority combines how bad the activity is with how important the target is.
| Factor | Raises priority |
|---|---|
| Asset criticality | Domain controller, payment system, customer database |
| User privilege | Administrator or service account |
| Attack stage | Signs of lateral movement, exfiltration or ransomware over early reconnaissance |
| Confidence | Several correlated signals or a known malicious indicator |
| Spread | Same pattern across many hosts |
A simple severity scale (critical, high, medium, low) with target response times keeps triage consistent across shifts.
Escalation
Tier I escalates when an alert is confirmed or likely malicious, when it is beyond their authority or skill, or when the playbook says so. Tier II performs deeper analysis and containment decisions.
Tier III handles advanced threats, hunting and malware analysis. The SOC manager is informed of critical incidents.
Alert fatigue
When analysts face too many low value alerts, they start to skim and may close real attacks. Causes include untuned rules, duplicate alerts, and alerts with no context. Fixes include tuning, grouping related alerts into one case, automated enrichment with SOAR, and removing rules with no true positives.
A worked example
Tier I receives a medium alert: "Outbound connection to suspicious domain" from a user's laptop. The analyst checks the proxy log and sees the connection happened. Threat intelligence lists the domain as a known phishing kit host, first seen two days ago.
The email gateway shows the user received a message with a link to that domain an hour earlier.
The analyst classifies it as a true positive, raises the priority to high because credentials may have been entered, documents the evidence, and escalates to Tier II with a recommendation to reset the user's password and check for other recipients.
How the exam asks about this
- "An alert fires, but the activity is a scheduled vulnerability scan approved by IT. How is it classified?" → A false positive or benign true positive; close with notes and consider tuning.
- "Which outcome is most dangerous for a SOC?" → A false negative, because an attack happened with no alert.
- "Which factor most raises an alert's priority?" → The criticality of the affected asset, such as a domain controller.
What to remember for the exam
- Triage order: acknowledge, validate, enrich, classify, prioritize, decide, document.
- True positive = real and alerted; false positive = alerted but benign; false negative = real but missed.
- Priority combines severity of activity with criticality of the asset and user.
- Tier I triages and escalates; Tier II investigates and contains; Tier III hunts and handles advanced threats.
- Alert fatigue is reduced by tuning, grouping and automated enrichment.
Never close an alert as a false positive without checking the raw events. "It usually is noise" is how real attacks are missed.
Common mistakes
Acting before validating. Isolating a server on an unconfirmed alert can disrupt the business. Confirm first unless the playbook requires immediate action.
Treating all alerts as equal. A medium alert on a domain controller can matter more than a high alert on a test machine.
Poor documentation. Without notes, the next shift repeats the work and patterns across alerts are lost.
Check yourself
What is the first goal of alert triage?
To validate whether the alert reflects real activity and is malicious, before deciding priority and next steps.
What does enrichment add to an alert?
Context such as asset criticality, user role, threat intelligence reputation and related alert history.
When should a Tier I analyst escalate?
When an alert is confirmed or likely malicious, beyond their authority or skill, or when the playbook calls for escalation.
Topic 5 of 6 in Incident Detection and Triage
Test yourself on Incident Detection and Triage
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.